Creating an Authorization Policy for User Management

Managing Authorization Policies 15-9 Figure 15–6 The Policy Assignment Page

13. Under Assign by Rule, select Management Chain of User to assign the direct and

indirect managers of the user to the authorization policy.

14. To assign roles to the authorization policy:

a. Click Add. The Assign Roles dialog box is displayed.

b. Click the Search icon to display the list of roles in the Available Roles list.

c. From the Available Roles list, select one or more roles, and then click the

Move or Move All buttons to move the selected roles to the Organizations to Add list.

d. Click Save. The selected roles are added to the table in the Assignment page.

15. Under Assignment Security Setting, select Assignee must be a member of the

Users Organization to specify that the authorization policy is to be applied only for the users that are members of the same organization in which the policy is applied.

16. Click Next. The Confirmation page of the Authorization Policy wizard is

displayed with details specified in the steps of the wizard.

17. Click Finish. The authorization policy is created.

15.2.2.2 Creating an Authorization Policy for Role Management

You can create custom authorization policies for role management to control the access to role management operations. For example, you can specify that users belonging to a Note: To remove a role from the table in the Assignment page, click Remove . 15-10 Oracle Fusion Middleware Users Guide for Oracle Identity Manager particular role can search for roles and role categories and view role details and role category details for all roles or for some selected roles. But the users belonging to that particular role will not be allowed to perform other role management operations. To create an authorization policy for Oracle Identity Manager role management feature: 1. On the Welcome page of Oracle Identity Administration, under Authorization Policies, click Create New Policy. Alternatively, you can: ■ Click the Authorization Policy tab, and then click the Authorization Policy icon on the toolbar. ■ From the Actions menu, select Create. The Basic Policy Information page of the Authorization Policy wizard is displayed. 2. In the Policy Name field, enter the name of the authorization policy. 3. In the Description field, enter a description of the authorization policy. 4. In the Entity Name field, select an entity name based on the authorization feature you want the assignee to have. To create an authorization policy for role management, select Role Management.

5. Click Next. The Permissions page is displayed.

6. Select the permissions that you want to enable for the authorization policy. To select all permissions, select Enable All Permissions at the top of the table.

7. Click Next. The Data Constraints page is displayed.

8. Select any one of the following options:: ■ All Roles: To specify that the authorization policy is applicable to all roles in Oracle Identity Manager including all the child roles. ■ Selected Roles: To specify that the authorization policy is applicable to selected roles only. The roles selected in the Data constraint page are roles on which action is to be performed. 9. If you select the Selected Roles option, then you must select the roles for which the authorization policy is been created. To do so:

a. Click Add Role. The Assign Roles dialog box is displayed.

b. Click the Search icon to display all roles in the Available Roles list. c. Select the roles for which you want to apply the authorization policy.

d. Click the Move or Move All buttons to move the roles to the Roles to Assign

list. e. Click Save. The selected roles are added to the Data Constraints page of the Authorization Policy wizard. 10. To remove a selected role from the Data Constraints page: Note: The pages in the Create Policy wizard are dynamically generated based on the Entity Name selection in the Basic Policy Information page. Managing Authorization Policies 15-11

a. Select the role, and then click Remove. A message box is displayed asking for

confirmation.

b. Click OK to confirm.

11. In the Data Constraints page, under Role Security Setting, select Hierarchy Aware

Include all Parent Roles to specify that the authorization policy is applicable to Roles, which are added as parent Roles.

12. Click Next. The Policy Assignment page is displayed. In this page, you can add

and remove roles as described in steps 10 and 11. Roles selected in the Policy Assignment page are roles whose direct and indirect members will perform the action based on the policy.

13. Click Next. The Confirmation page is displayed with Basic Policy Information and

details about permissions, data constraints, and assignments.

14. Click Finish. The authorization policy is created.

15.2.2.3 Creating an Authorization Policy for Authenticated User Self Service

You can create custom authorization policies for authenticated user self service to control the access of user self service operations. For example, if you want to make a few self profile attributes available for modification by a user or a group of users but do not want the users to modify some other self profile attributes, then create a custom authorization policy for user self service with permission to modify a set of user profile attributes, and assign roles to the policy. The users who belong to the assigned roles will have permission to modify the self profile attributes as specified in the authorization policy. To create an authorization policy for authenticated user self service:

1. On the Welcome page of Oracle Identity Administration, under Authorization

Policies, click Create New Policy. Alternatively, you can: ■ Click the Authorization Policy tab, and then click the Authorization Policy icon on the toolbar. ■ From the Actions menu, select Create. The Basic Policy Information page of the Authorization Policy wizard is displayed.

2. In the Policy Name field, enter the name of the authorization policy.

3. In the Description field, enter a description of the authorization policy.

4. In the Entity Name field, select an entity name based on the authorization feature

you want the assignee to have. To create an authorization policy for role management, select Self Service User Management.

5. Click Next. The Permissions page is displayed.

6. Select the permissions that you want to enable for the authorization policy. For

example, if you want to allow the user to modify self profile, then select Modify User Profile. To select all permissions, select Enable All Permissions at the top of the table. Note: The pages in the Create Policy wizard are dynamically generated based on the Entity Name selection in the Basic Policy Information page. 15-12 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 7. You can modify some permissions that have attribute-level settings. To do so:

a. Select the permission, for example, Modify User Profile, and click Edit

Attributes on the toolbar. The Attribute Settings window is displayed with a list of all user attributes.

b. Select the attributes that you want to allow the user to modify, and click Save.

8. Click Next. The Policy Assignment page is displayed with a table that contains the

roles that are assigned to this policy.

9. To add a role to the policy, click Add. Alternatively, from the Actions menu, select

Add . The Assign Roles window is displayed. 10. Search for role in the Assign Roles window, select the role or roles that you want to assign to the policy, and click Add. The role is added to the policy assignment table. The authorization Policy will be enabled for all the members of the assigned roles. To remove a role from the policy, select the role in the policy assignment table, and click Remove. 11. Click Next. The Confirmation page is displayed with Basic Policy Information and details about permissions, data constraints, and assignments.

12. Click Finish. The authorization policy is created.

15.2.3 Creating Authorization Policies Based on Existing Policies

You can create an authorization policy by using the general, permissions, data constraints, and assignment information from another authorization policy already existing in Oracle Identity Manager. To do so: 1. Search for the authorization policy from which you want to use information to create another policy.

2. Select the policy. From the Actions menu, select Create Like. The Authorization

Policy wizard is displayed. 3. In the Basic Policy Information page, edit the Policy Name, Description, and Entity Name fields to specify new values. 4. Perform the steps to complete the wizard as described in Creating Custom Authorization Policies on page 15-5.

15.2.4 Viewing and Modifying Authorization Policies

You can view and modify authorization policies, and change the general information, permissions, data constraints, and assignments of the authorization policies. To do so: 1. In the Authorization Policy tab of the Administration Console, in the left pane, search for authorization policies. The policies matching the search criteria are displayed in the search results table. Note: The options for authorization policy modification changes dynamically based on the entity type selected for the policy. In this procedure, the example of an authorization policy for role management is used.